Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: strange traffic ?
From: Jack <fulldis () jackmccarthy com>
Date: Fri, 26 Mar 2004 13:04:33 -0800 (PST)

More details are definitely needed, but let me ask a very basic question...is
it safe to assume that you're running some sort of AV software?  You're not
infected with a Blaster varient, right?  

http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html


--- "Aditya, ALD [Aditya Lalit Deshmukh]"
<aditya.deshmukh () online gateway technolabs net> wrote:
Dear list,
i am seeing strange traffic ... first something connects to 139 on windows
workstation ... 2 packets causes the svchost to crash.
and then i start seeing traffic to port 4444 from the same ip.

what is this traffic i am seeing ? any new kind of malware trying to open of
port 4444 with the initial vector of infection on port 139 ?


the machine is fully patched and protected by firewall from outside world
with a sniffer logging all the data ie scr, dst ip and ports numbers ( this
is how i know the above info ) 

and nothing suspecipous is there on the machine also ... since the machine is
under heavy watch anything unsual would be caught immediatly.... 


-aditya


________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]